INTERNET DRAFT Donald E. Eastlake 3rd Motorola Expires June 2002 December 2001 Internet Open Trading Protocol Version 2 Requirements Status of this Memo Distribution of this document is unlimited. Comments should be sent to the IETF TRADE working group . This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC 2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Copyright Notice Copyright (C) 2001, The Internet Society. All Rights Reserved. Abstract Version 2 of the Internet Open Trading Protocol (IOTP) will extend the interoperable framework for Internet commerce capabilities of Version 1 while replacing the XML messaging and digital signature part of IOTP v1 with standards based mechanisms. Additional features are listed and divided into those the will, may, and will not be included. D. Eastlake 3rd [Page 1] INTERNET-DRAFT IOTP v2 Requirements December 2001 Table of Contents Status of this Memo........................................1 Copyright Notice...........................................1 Abstract...................................................1 Table of Contents..........................................2 1. Introduction............................................3 2. Design Principles and Scope.............................3 3. Requirements............................................3 4. Security Considerations.................................4 References.................................................6 Authors Addresses..........................................7 Full Copyright Statement...................................8 File name and Expiration...................................8 D. Eastlake 3rd [Page 2] INTERNET-DRAFT IOTP v2 Requirements December 2001 1. Introduction Verion 2 of the Internet Open Trading Protocol (IOTP) will extend the interoperable framework for Internet commerce capabilities of Version 1 [RFC 2801] as described in Section 3 below. In addition, it will replace the ad hoc XML messaging and digitial signature [RFC 2802] parts of IOTP v1 with standards based mechanisms [RFC 3075]. This draft gives requirements for IOTP Version 2 by describing design principles and scope and dividing features into those which will, may, or will not be included. 2. Design Principles and Scope 1. The specification must describe the syntax and processing necessary for an extension of the interoperable framework for Internet commerce described in IOTP V1.0 [RFC 2801]. 2. Keep changes to IOTP V1.0 to a minimum. 3. Maintain all existing functionality of IOTP V1.0. 4. Test all XML DTDs and/or Schemas and XML examples in the specification to insure that they are well-formed. 5. Create usage/implementation guidance information, probably as a separate document. 6. It should be designed to work well with other protocols such as ECML [RFC 3106]. 7. IOTP Version 2 should be developed as part of the broader Web design philosophy of decentralization, URIs, Web data, and modularity /layering / extensibility. [Berners-Lee, WebData] In this context, this standard should take advantage of existing provider (and infrastructure) primitives. 3. Requirements IOTP Version 2 will include the following: 1. Be a superset of IOTP Version 1. 2. Provide for the Dynamic Definition of Trading Sequences. I.E., transactions will not be limited, as with v1, to a single payment and a single delivery with delivery occurring after payment. D. Eastlake 3rd [Page 3] INTERNET-DRAFT IOTP v2 Requirements December 2001 Instead, it will be possible to propose an arbitrary sequence of transaction steps. 3. Include specification of an Offer Request Block. 4. Support Improved Problem Resolution (extend to cover presentation of signed receipt to customer support party, better defined Customer Care role, etc.) 5. Add provisions to indicate and handle a payment protocol not tunneled through IOTP. 6. Add support for server based wallets. The following may be include in IOTP v2: 1. Support Repeated/ongoing payments. For example, a means to specify that a customer approval covers not only the instant purchase but also some limited number of future purchase with some total or per purchase spending limit. 2. Enhanced Server to Server messages. For example, a means for a Delivery Handler to inform a Payment Handler that goods have actually shipped, which may be a pre-condition for making a charge against a credit card. 3. Include the ability to add both fields and attributes to existing trading blocks in addition to the present ability to add entirely new trading blocks. The following are out of scope for IOTP version 2: 1. Legal or regulatory issues surrounding the implementation of the protocol or information systems using it. 2. Design of an XML Messaging Layer. Instead, whatever is or appears most likely to become the standard XML messaging layer will be used. This includes a standard enveloping, addressing, and error reporting framework. 3. Design of XML Digital Signatures. Instead, the existing standard [RFC 3075] will be used. 4. Security Considerations As provided above, IOTP v2 will provide optional authentication via standards based XML Digital Signatures [RFC 3075]; however, neither IOTP v1 nor v2 provide a confidentiality mechanism. Both require the D. Eastlake 3rd [Page 4] INTERNET-DRAFT IOTP v2 Requirements December 2001 use of secure channels such as those provided by TLS [RFC 2246] or IPSEC for confidentiality and depend on the security mechanisms of any payment system used in conjunction with them to secure payments. D. Eastlake 3rd [Page 5] INTERNET-DRAFT IOTP v2 Requirements December 2001 References [Berners-Lee] - "Axioms of Web Architecture: URIs", , "Web Architecture from 50,000 feet", [RFC 2026] - "The Internet Standards Process -- Revision 3", S. Bradner, October 1996. [RFC 2246] - "The TLS Protocol: Version 1.0", T. Dierks, C. Allen. January 1999. [RFC 2706] - "ECML v1: Field Names for E-Commerce", D. Eastlake, T. Goldstein, October 1999. [RFC 2801] - "Internet Open Trading Protocol - IOTP Version 1.0", D. Burdett, April 2000. [RFC 2802] - "Digital Signatures for the v1.0 Internet Open Trading Protocol (IOTP)", K. Davidson, Y. Kawatsura", April 2000. [RFC 3075] - "XML-Signature Syntax and Processing", D. Eastlake, J. Reagle, D. Solo, March 2001. [RFC 3106] - "ECML v1.1: Field Names for E-Commerce", D. Eastlake, T. Goldstein, April 2001. [WebData] - "Web Architecture: Describing and Exchanging Data", [XML] - "Extensible Markup Language (XML) 1.0 (Second Edition)", , T. Bray, J. Paoli, C. M. Sperberg-McQueen. D. Eastlake 3rd [Page 6] INTERNET-DRAFT IOTP v2 Requirements December 2001 Authors Addresses Donald E. Eastlake 3rd Motorola 155 Beaver Street Milford, MA 01757 USA Phone: +1-508-261-5434 (w) +1-508-634-2066 (h) Email: Donald.Eastlake@motorola.com D. Eastlake 3rd [Page 7] INTERNET-DRAFT IOTP v2 Requirements December 2001 Full Copyright Statement Copyright (c) 2001 The Internet Society, All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. File name and Expiration This file is draft-ietf-trade-iotp2-req-03.txt. It expires June 2002. D. Eastlake 3rd [Page 8]